X-Git-Url: http://git.onelab.eu/?p=myplc.git;a=blobdiff_plain;f=plc.d%2Fhttpd;h=48c8beb4ff07b16b2af25a5a0287c2c98d25a934;hp=993b54370ea2baa10d769ab17b22c15f2681c74e;hb=4cef883d78f5efb6fe66a4a9404946e35aebb47f;hpb=391310e122de0536c08f62bd46acd3b3b7b13964 diff --git a/plc.d/httpd b/plc.d/httpd index 993b543..48c8beb 100755 --- a/plc.d/httpd +++ b/plc.d/httpd @@ -1,14 +1,12 @@ #!/bin/bash # -# priority: 700 +# priority: 600 # # Configure Apache web server # # Mark Huang # Copyright (C) 2006 The Trustees of Princeton University # -# $Id: httpd 350 2007-05-11 10:58:44Z thierry $ -# # Source function library and configuration . /etc/plc.d/functions @@ -23,6 +21,17 @@ php_ini=/etc/php.ini httpd_conf=/etc/httpd/conf/httpd.conf ssl_conf=/etc/httpd/conf.d/ssl.conf plc_conf=/etc/httpd/conf.d/plc.conf +php_fpm_conf=/etc/php-fpm.d/plc.conf +php_fpm_dir=$(dirname $php_fpm_conf) + +function disable_file () { + file=$1; shift + [ -f $file ] && mv -f $file $file.disabled +} +function enable_file () { + file=$1; shift + [ ! -f $file ] && mv -f $file.disabled $file +} case "$1" in start) @@ -35,24 +44,66 @@ case "$1" in MESSAGE=$"Starting web server" dialog "$MESSAGE" - # Set the document root to /data/var/www/html (static files - # and PlanetLabConf only, no Drupal or admin pages) if the web - # server should not run on this machine. + # set document root - not really useful on fedora but just in case + sed -i -e "s@^DocumentRoot.*@DocumentRoot \"$DocumentRoot\"@" $httpd_conf + # whether WWW is enabled or not : if [ "$PLC_WWW_ENABLED" != "1" ] ; then - sed -i -e "s@^DocumentRoot.*@DocumentRoot \"/data$DocumentRoot\"@" $httpd_conf - ln -nsf $DocumentRoot/PlanetLabConf /data$DocumentRoot/PlanetLabConf + # avoid hitting drupal, that would try to connect to the db and create noise + disable_file $DocumentRoot/index.php else - sed -i -e "s@^DocumentRoot.*@DocumentRoot \"$DocumentRoot\"@" $httpd_conf - rm -f /data$DocumentRoot/PlanetLabConf + enable_file $DocumentRoot/index.php fi # Set the default include path - include_path=".:$DocumentRoot/planetlab/includes:$DocumentRoot/generated:/etc/planetlab/php:/usr/share/plc_api/php" + include_path=".:$DocumentRoot/planetlab/includes:$DocumentRoot/plekit/php:$DocumentRoot/generated:/etc/planetlab/php:/usr/share/plc_api/php" sed -i -e "s@[;]*include_path = \"\.:.*\"@include_path = \"$include_path\"@" $php_ini + # Set open_basedir so as to avoid leaks + open_basedir="$DocumentRoot:/etc/planetlab/php:/usr/share/plc_api/php:/var/log/myslice:/var/tmp/bootmedium:/var/log/bm:/tmp" + sed -i -e "s@[;]*open_basedir =.*@open_basedir = \"$open_basedir\"@" $php_ini + + # for php-5.3 under fedora12, otherwise issues tons of warning messages + # Set timezone in php.ini if not already there + if grep '^;date.timezone' $php_ini >& /dev/null; then + dialog 'Setting PHP timezone to GMT' + sed -i -e 's,^;date.timezone.*,date.timezone = GMT,' $php_ini + fi + + if grep '^short_open_tag = Off' $php_ini >& /dev/null; then + sed -i -e 's,^short_open_tag = Off,short_open_tag = On,' $php_ini + fi + + ## patch php.ini + # memory limit + sed -i -e 's,^memory_limit = 32M *;,memory_limit = 80M ; patch myplc -- ,' $php_ini + # log_errors : is On by default + # error_log + if ! grep '^error_log *=' $php_ini > /dev/null ; then + echo 'error_log = /var/log/php.log' >> $php_ini + touch /var/log/php.log + chmod 666 /var/log/php.log + fi + + # configure php-fpm as well if present (starting with f27) + if [ -d $php_fpm_dir ] ; then + cat > $php_fpm_conf << EOF +[www] +php_value[include_path] = $include_path +php_value[open_basedir] = $open_basedir +php_value[date.timezone] = GMT +php_value[short_open_tag] = On +php_value[memory_limit] = 80M +EOF + # this is needed because otherwise, the first time + # we do this configuration, the service is already up + # and the config is usable only the second time + systemctl restart php-fpm + fi + # Disable default Listen directive sed -i -e '/^Listen/d' $httpd_conf + plc_api_path_noslash=$(echo $PLC_API_PATH | sed -e s,/,,g) # Set the port numbers for server in WWW API BOOT ; do enabled=PLC_${server}_ENABLED @@ -83,29 +134,40 @@ case "$1" in previous_http_port=PLC_${previous_server}_PORT previous_https_port=PLC_${previous_server}_SSL_PORT - if [ "${!http_port}" = "${!previous_http_port}" ] ; then + if [ -z "${http_port}" ]; then + skip_http=1; + elif [ -z "${!http_port}" ]; then + skip_http=1; + elif [ "${!http_port}" = "${!previous_http_port}" ] ; then skip_http=1 fi - if [ "${!https_port}" = "${!previous_https_port}" ] ; then + if [ -z "${https_port}" ]; then + skip_https=1 + elif [ -z "${!https_port}" ]; then + skip_https=1 + elif [ "${!https_port}" = "${!previous_https_port}" ] ; then skip_https=1 fi done # HTTP configuration - if [ $skip_http -eq 0 -a -n "${!http_port}" ] ; then + if [ $skip_http -eq 0 ] ; then cat < + # Make sure that the admin web pages are always accessed via SSL Redirect /db https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/db Redirect /planetlab https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/planetlab - Redirect /$PLC_API_PATH https://$PLC_API_HOST:$PLC_API_PORT/$PLC_API_PATH +# as a matter of fact most xmlrpc clients won't follow the redirection +# so this is mostly rethorical, but just in case... + Redirect /$plc_api_path_noslash https://$PLC_WWW_HOST:$PLC_WWW_SSL_PORT/$plc_api_path_noslash + EOF fi # HTTPS configuration - if [ $skip_https -eq 0 -a -n "${!https_port}" ] ; then + if [ $skip_https -eq 0 ] ; then # XXX Cannot support NameVirtualHost over SSL. If # the API, boot, and web servers are all running # on the same machine, the web server certificate @@ -114,36 +176,89 @@ EOF -e "s/^Listen .*/Listen ${!https_port}/" \ -e "s///" \ $ssl_conf + # this is used to locate the right certificates + server_lower=$(echo $server | tr 'A-Z' 'a-z') + + # which one is used is currently configured in myplc.spec, + # with mod_python preferred + if rpm -q mod_python >& /dev/null ; then + configure_for_mod_python=true + elif rpm -q mod_wsgi >& /dev/null ; then + configure_for_mod_wsgi=true + else + echo "Requires mod_python or mod_wsgi.... exiting" + exit 1 + fi + + # It would be tempting to use here + # but early tests showed this could be tricky/fragile + # So let's hard-wire it for one module + # A lot of trial-and -error was involved in getting this that way... + + if [ -n "$configure_for_mod_python" ] ; then +#################### for mod_python + cat < + SetHandler mod_python + PythonPath "sys.path + ['/usr/share/plc_api']" + PythonHandler apache.ModPython + +EOF + + elif [ -n "$configure_for_mod_wsgi" ] ; then +#################### for mod_wsgi + cat < + + # SSL + SSLEngine On + SSLCertificateFile /etc/planetlab/${server_lower}_ssl.crt + SSLCertificateKeyFile /etc/planetlab/${server_lower}_ssl.key + SSLCertificateChainFile /etc/planetlab/${server_lower}_ca_ssl.crt + + WSGIScriptAlias /$plc_api_path_noslash /usr/share/plc_api/apache/plc.wsgi +# xxx would be cool to be able to tweak this through config + WSGIDaemonProcess plcapi-wsgi-ssl user=apache group=apache processes=1 threads=25 + WSGIProcessGroup plcapi-wsgi-ssl + + + Options +ExecCGI + $(apache_allow) + + + +EOF + fi fi done >$plc_conf # Set custom Apache directives ( - if [ "$PLC_API_ENABLED" = "1" ] ; then - cat < - SetHandler mod_python - PythonPath "sys.path + ['/usr/share/plc_api']" - PythonHandler ModPython - + # could be restricted to boot boxes but harmless.. + cat < - Deny from all - + $(apache_forbid) + EOF fi + # redirect www requests if not on the right server if [ "$PLC_WWW_ENABLED" != "1" ] ; then cat <>$plc_conf # Make alpina-logs directory writable for bootmanager log upload @@ -195,16 +310,9 @@ define('PLANETLAB_SUPPORT_EMAIL_ONLY', PLC_MAIL_SUPPORT_ADDRESS); ?> EOF - ## patch php.ini - # memory limit - sed -i -e 's,^memory_limit = 8M *;,memory_limit = 24M ; patch myplc -- ,' $php_ini - # log_errors : is On by default - # error_log - if ! grep '^error_log *=' $php_ini > /dev/null ; then - echo 'error_log = /var/log/php.log' >> $php_ini - touch /var/log/php.log - chmod 666 /var/log/php.log - fi + ## make room for logs + touch /var/log/plcapi.log + chmod 666 /var/log/plcapi.log plc_daemon httpd check